Complete repository security, performance, and UX audit

[ryanbaumann]

Problem and resulting behavior

The repository audit began with incorrect Accept-Encoding selection and uncovered related HTTP, authentication, CSP, dependency, documentation, and responsive accessibility issues. Requests now negotiate valid representations, writer authentication fails closed on malformed Google claims, portfolio inline scripts are authorized per page, broad provider permissions are reduced, and the affected demo interfaces work at the narrowest supported viewport and from the keyboard.

Essay copy and the proposed fine-tuning replacement visuals remain unchanged after owner review.

Implementation

• Complete RFC 9110 content negotiation for static and generated responses, including identity preferences, 406 responses, Vary preservation, weak/wildcard validators, bodyless HEAD, and stream cleanup.
• Require exact Google email-verification and expiry claim formats before creating a private writer session.
• Generate SHA-256 hashes from each final portfolio HTML file and bind them to that file's gateway CSP. Add a font-only profile so Infographic Agent no longer inherits Maps script and evaluation permissions.
• Resolve Atlas's vulnerable fflate version with a targeted override and update Strava's development brace-expansion lock resolution. The remaining Atlas image-size chain is documented because the current registry release has no patch.
• Add a reproducible, dependency-free static gateway benchmark. It supports the measured HEAD CPU reduction; noisy overlapping GET ranges are recorded without claiming a general throughput improvement.
• Align contact, privacy, subscription, demo UI, and README descriptions with implemented behavior. Render the authored contact context.
• Fix 320 px overflow, 44 px targets, reduced-motion behavior, and focus entry, containment, Escape dismissal, and restoration in the affected API-key dialogs.
• Replace the preliminary audit with a finding register, measured evidence, content dispositions, residual risks, and follow-up boundaries.

Validation

• npm --prefix gateway test — 183 passed.
• npm --prefix portfolio test — 48 passed and portfolio build passed after the owner-review reverts.
• npm run test:labs — 49 passed.
• npm run check:content — 34 entries, 0 errors, 0 warnings after the owner-review reverts.
• node scripts/build-local.mjs --skip-install — all 9 manifest apps built and staged after the owner-review reverts.
• node scripts/smoke.mjs — 21 passed after the owner-review reverts.
• Atlas — typecheck, 579 unit tests, 2 source checks, and production build passed.
• Strava Explorer — 38 tests, lint, and production build passed.
• AQI Map, Isochrones, Hairstyle AI Studio, Infographic Agent, and Voice Studio focused tests/checks and production builds passed.
• Browser review — 144 route/viewport/theme checks without page errors; primary interactions and focused responsive/dialog regressions passed.
• Independent security review found no material blockers.
• Final PR comparison confirms zero changes to essay sources, fine-tuning article visuals/social card, or their evidence ledger relative to the pre-implementation head.
• Final diff and staged-output secret scans found no known secret patterns.
• Fresh production audits: 7 package trees report zero known vulnerabilities; Atlas retains 8 high entries in the unpatched image-size chain documented in the audit.

Limits and follow-up

Live Maps/WebGL, Gemini generation, email delivery, deployment, and publication were not exercised in the credential-free review. The shared-host GET benchmark was too noisy to justify an asynchronous filesystem rewrite. The complete evidence and remaining checks are recorded in docs/REPOSITORY_AUDIT_2026-09.md.